mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat: compartmentalize idmail

Browse source
This commit is contained in:
oddlama 2024-08-01 01:30:43 +02:00
parent 76163bad98
commit 58afd52f99
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
3 changed files with 13 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

19
hosts/envoy/idmail.nix
View file

@ -21,12 +21,12 @@
shortHash = x: lib.substring 0 16 (builtins.hashString "sha256" "${globals.salt}:${x}");
in {
environment.persistence."/persist".directories = [
environment.persistence."/persist".directories = lib.trace "stalwart backups to dusk!" [
{
directory = "/var/lib/idmail";
user = "idmail";
group = "idmail";
mode = "0700";
directory = config.services.idmail.dataDir;
user = "stalwart-mail";
group = "stalwart-mail";
mode = "4770";
}
];
@ -52,15 +52,12 @@ in {
network = "internet";
};
#systemd.tmpfiles.settings."50-idmail"."${dataDir}".d = {
# user = "idmail";
# mode = "0750";
#};
services.idmail = {
enable = true;
# Stalwart will change permissions due to SQLite implementation.
# Therefore, run as stalwart-mail since we don't allow reading
# stalwarts folder anyway (sandboxing is on).
user = "stalwart-mail";
dataDir = "/var/lib/stalwart-mail";
provision = {
enable = true;
users.admin = {